Web browsers are increasingly becoming a single-stop resource for computing needs including information access, personal communications, office tasks, and e-commerce. Conventional Web applications synthesize the world of data and code, offering rich services through Web browsers and rivaling those of desktop PCs. Web browsers have evolved from a single-principal platform on which users browse one site at a time into a multi-principal platform on which data and code from mutually distrusting sites interact programmatically in a single page on the client side, enabling feature-rich “Web 2.0” applications (or “mashups”) that offer close-to-desktop experiences. These applications also resemble the PC operating environment, where mutually distrusting users share host resources.
However, unlike PCs, which utilize multi-user operating systems for resource sharing, protection, and management, conventional browsers provide a limited binary trust model and protection mechanisms suitable only for a single-principal system. In particular, conventional browsers can typically only offer either no trust across principals through complete isolation or full trust through incorporating third party code as libraries. Consequently, Web programmers are forced to make tradeoffs between security and functionality, and often times must sacrifice security for functionality.
Accordingly, there exists a need in the art for protection and communication mechanisms that can enhance the security of a browser without an undue sacrifice in functionality.